Technical Summary: Understanding the "Airport" Censorship Circumvention Ecosystem in China

Problem Statement

In China, a robust underground market has emerged for commercial proxy services known as "airports" (机场，jīchǎng), which allow users to bypass the Great Firewall (GFW). Despite their widespread adoption and critical role in the daily internet usage of millions of Chinese citizens, airports remain largely absent from academic literature. Existing research has focused on state-level censorship mechanisms (e.g., IP blocking, TLS SNI filtering) and free, volunteer-run tools like Tor or Snowflake. However, the commercial, subscription-based "airport" model presents a unique threat landscape and operational architecture that differs significantly from both state censorship and traditional academic circumvention proposals. There is a lack of systematic understanding regarding their prevalence, technical architecture, performance characteristics, and the security risks they introduce to users.

Methodology

The authors employed a mixed-methods approach combining user surveys, social media analysis, and active network measurements to study the airport ecosystem:

1. User Survey: An anonymous survey was conducted with 1,667 users in China who regularly bypass censorship. Recruitment occurred through trusted channels within the circumvention community (Twitter/X, Telegram, Net4People BBS) to mitigate selection bias and ensure safety. The survey gathered data on tool adoption, selection criteria, costs, and perceived challenges.
2. Ecosystem Discovery: The researchers identified active airports through two primary channels:
   • Telegram Scraping: Manual analysis of seven high-traffic Telegram announcement channels dedicated to airport advertisements.
   • Active Internet Scanning: Scanning 1,008 CZDS zone files (covering 84% of domains seen in Telegram ads) for specific open-source portal fingerprints (e.g., v2board, sspanel).
3. Subscription and Measurement: The team purchased subscriptions from 35 representative airports (categorized by popularity, price, age, and source). They then conducted active measurements from three vantage points in mainland China (Beijing, Guangzhou, Shanghai) to evaluate:
   • Latency: Round-trip time (RTT) to ingress nodes and Time-to-First-Byte (TTFB) for external resources.
   • Throughput: Download speeds over a 24-hour period, comparing airport performance against direct connections.
   • Architecture: Geolocation of ingress and egress nodes to infer the underlying transport mechanism.
   • Access Restrictions: Testing access to geo-restricted services (e.g., Netflix, ChatGPT) and a subset of 368 known censored domains (from the Citizen Lab CN test list) to detect operator-imposed self-censorship.

Key Contributions and Results

1. Prevalence and User Preference

Airports are the most popular off-the-shelf circumvention tool in China, used by 55% of survey respondents. Users prefer them over self-hosted setups and other third-party tools due to a unique balance of stability (61%), cost (48%), and speed (35%). The median monthly cost for airport users is $2.80, significantly lower than the median cost for self-hosting ($4.60) and other commercial tools.

2. Ecosystem Scale and Standardization

The study identified 3,431 active airport portals. The ecosystem is highly standardized, with 95% of portals powered by two open-source frameworks: v2board and sspanel. This standardization lowers the barrier to entry for operators but creates correlated risks, as vulnerabilities in these shared templates can affect hundreds of independent operators simultaneously.

3. Distinctive Multi-Hop Architecture

Airports utilize a decoupled architecture that separates ingress (entry) and egress (exit) nodes:

• Ingress: 92% of ingress nodes are located within mainland China (primarily Guangdong and Beijing).
• Egress: Traffic exits almost exclusively outside mainland China (commonly Hong Kong, US, Japan, Taiwan, Singapore).
• Transport: Operators reportedly use International Ethernet Private Lines (IEPLs) to connect these nodes, bypassing GFW-induced congestion.
• Performance: This architecture allows airports to outperform direct connections. In measurements, airport throughput was often twice as fast as direct connections (median 131.60 Mbps vs. 64.24 Mbps) and remained stable during peak hours, supporting high-bandwidth tasks like HD video streaming.

4. Pricing Models

Unlike traditional flat-rate VPNs, airports predominantly use a byte-metered subscription model (e.g., 10 TB/month), similar to mobile data plans. Prices vary widely, with a median of $16/TB. Longer subscription terms generally offer better value, and specific nodes providing access to high-demand services (like ChatGPT) may incur additional costs.

5. Access Capabilities and Self-Censorship

• Geo-Restricted Access: Airports generally provide better access to geo-restricted services (e.g., Netflix, Disney+, Dazn) compared to other working circumvention tools. For instance, 10 out of 15 tested airports could access Netflix, whereas standard non-airport tools were often blocked.
• Self-Censorship: Contrary to the assumption that circumvention tools provide unrestricted access, the study found that over half (198 of 368) of tested censored domains were blocked by at least one airport.
  • Falun Gong: 12 airports blocked Falun Gong-related sites.
  • News Media: 9 airports blocked overseas news outlets (e.g., RFA, VOA).
  • Domestic Sites: Some airports blocked popular Chinese sites (e.g., banking, social media) likely to prevent egress IP leakage or due to operator ideology.
  • Motivation: This self-censorship appears driven by operator risk mitigation (avoiding government crackdowns) and personal ideology, effectively replacing state censorship with opaque commercial filtering.

6. Security and Operational Risks

The ecosystem introduces significant risks:

• Identity Linkage: Payments are processed through real-name systems like Alipay and WeChat Pay, linking users directly to operators.
• Instability: Users frequently report service interruptions due to takedowns, IP blocking, or operator "runaways" (abrupt shutdowns).
• Configuration Complexity: Users face challenges in configuring client software (e.g., Clash, Shadowrocket) and managing traffic splitting rules to avoid DNS leaks.
• Vulnerability Propagation: The reliance on shared open-source templates means that a single bug or leak can compromise thousands of users across the ecosystem.

Significance and Claims

The paper claims to be the first systematic study of the "airport" ecosystem. Its significance lies in:

1. Shifting the Focus: Moving the academic conversation from purely technical evasion (obfuscation, protocol design) to the socio-technical reality of commercial, subscription-based circumvention services.
2. Revealing the "Free Access" Illusion: Demonstrating that bypassing the state GFW does not guarantee an uncensored path, as commercial operators impose their own filtering policies.
3. Highlighting New Risks: Identifying that the convenience of airports comes at the cost of user privacy (via payment linkage) and security (via shared vulnerabilities and opaque operators).
4. Informing Future Design: Suggesting that future circumvention research should focus on building resilient tools for operators (not just users) and developing mechanisms that address the specific trust and payment challenges inherent in the Chinese context, rather than simply replicating Western models.

The authors conclude that while airports are currently the most effective off-the-shelf solution for Chinese users, their fragility and the introduction of new control vectors by commercial operators necessitate a re-evaluation of how circumvention systems are designed and measured.